The Data Security Engineer Journeyman protects sensitive data across enterprise data platforms and tools in a highly regulated government environment, with a focus on operational execution and continuous improvement of data protection controls. This role implements and maintains encryption, access controls, and monitoring capabilities to ensure compliant, secure handling of structured and unstructured data across the client environment. The engineer collaborates closely with governance, compliance, and engineering teams to conduct risk assessments, support audits, and enable secure data sharing and analytics use cases.
Key Responsibilities- Design and implement data security architectures, including encryption for data at rest and in transit, tokenization, and key management using services such as KMS and HSMs.
- Configure and administer fine-grained access controls (RBAC/ABAC), identity federation, and privileged access management across databases, data lakes, and analytic platforms.
- Develop, document, and enforce data classification schemes and handling procedures aligned to applicable regulatory frameworks (e.g., NIST, FISMA, FedRAMP, HIPAA where appropriate).
- Conduct data-centric risk assessments, threat modeling, and control validation activities for data stores, pipelines, and integrations, and track remediation of identified gaps.
- Implement, tune, and maintain data loss prevention (DLP), activity monitoring, and anomaly detection capabilities for structured and unstructured data assets.
- Perform security reviews of data pipelines, APIs, and third-party data-sharing agreements to mitigate exfiltration, leakage, and inappropriate data exposure risks.
- Monitor, investigate, and respond to data security incidents, including log analysis, forensics support, incident documentation, and remediation follow-up.
- Maintain system security plans, control documentation, and audit evidence to support inspections, continuous monitoring, and certification and accreditation activities.
- Deliver data security awareness training and guidance to engineering, data, and analytics teams on secure data handling, access, and sharing practices.
Required Qualifications- Bachelor's degree in Information Assurance, Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent relevant experience.
- Typically 3-6 years of experience in data security, cybersecurity engineering, or data platform security in enterprise or federal IT environments.
- Hands-on experience implementing encryption, key management, and access control solutions for cloud or on-premises data platforms.
- Demonstrated experience configuring and managing RBAC/ABAC, identity federation, and privileged access controls for data systems.
- Experience conducting data-centric risk assessments, threat modeling, and security reviews of databases, data pipelines, APIs, or integrations.
- Ability to obtain and maintain a SECRET security clearance as required by the client.
- U.S. citizenship required to support a U.S.-only, federal IT environment.
Preferred Qualifications- Experience with cloud-native data services security in AWS, Azure, or GCP, including IAM, KMS, and data-specific controls.
- Relevant security certifications such as Security+, CISSP, CCSP, or vendor-specific cloud security certifications.
- Experience implementing and operating DLP and data governance tools (e.g., Microsoft Purview, AWS Macie, BigID) in enterprise environments.
- Background working with highly regulated government or public sector environments and aligning controls to NIST, FISMA, FedRAMP, or similar frameworks.
Compensation RangesCompensation ranges for ASM Research positions vary depending on multiple factors; including but not limited to, location, skill set, level of education, certifications, client requirements, contract-specific affordability, government clearance and investigation level, and years of experience. The compensation displayed for this role is a general guideline based on these factors and is unique to each role. Monetary compensation is one component of ASM's overall compensation and benefits package for employees.
DisclaimerThe preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.
